CVE-2017-15718 Exposure of Sensitive Information in Hadoop
CriticalCVSS 9.8
EPSS 3.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.hadoop/hadoop-main(Maven) | >= 2.7.3, <= 2.7.4 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | >= 2.7.3, < 2.7.5 | 2.7.5 |
| org.apache.hadoop/hadoop-main(Maven) | = 2.7.3 | No fix listed |
| org.apache.hadoop/hadoop-main(Maven) | = 2.7.4 | No fix listed |
| apache hadoop | = 2.7.3 | No fix listed |
| apache hadoop | = 2.7.4 | No fix listed |
| Apache Hadoop | = 2.7.3 to 2.7.4 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com vendor-advisory
- lists.apache.org
- [general] 20180124 CVE-2017-15718: Apache Hadoop YARN NodeManager vulnerability mailing-list